From 09e49aa23dc86cc09444515d6d39722a60626bca Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sun, 16 Aug 2026 09:07:16 +0200 Subject: [PATCH 1/3] gh: remove oidc config for codecov oidc auth cannot succeed from forked repository This reverts commit 87deb87e66442794908cbfb3212de6f0c5e7a2f8. Signed-off-by: Xavier Delaruelle --- .github/workflows/linux_tests.yaml | 30 ++++++++++++------------------ .github/workflows/macos_tests.yaml | 5 ++--- 2 files changed, 14 insertions(+), 21 deletions(-) diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index adf0625c9..522849ee2 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -67,10 +67,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -155,10 +154,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -239,10 +237,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -308,10 +305,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -379,10 +375,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -525,10 +520,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index 02660c30c..a98615f57 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -62,10 +62,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: From 8bbaafb1c8c9e79ecc713bd0153e02306e3d937a Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sun, 16 Aug 2026 11:22:31 +0200 Subject: [PATCH 2/3] gh: enable verbosity of codecov action Signed-off-by: Xavier Delaruelle --- .github/workflows/linux_tests.yaml | 6 ++++++ .github/workflows/macos_tests.yaml | 1 + 2 files changed, 7 insertions(+) diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index 522849ee2..23f8442b3 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -69,6 +69,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -156,6 +157,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -239,6 +241,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -307,6 +310,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -377,6 +381,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -522,6 +527,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index a98615f57..e97daca4b 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -64,6 +64,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() From 1ad5b07d398652e768794955eaac0ac166e7585b Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sun, 16 Aug 2026 11:30:27 +0200 Subject: [PATCH 3/3] gh: adapt triggers to avoid running actions on forked repo Signed-off-by: Xavier Delaruelle --- .github/workflows/completion_tests.yaml | 9 ++++++--- .github/workflows/easybuild_tests.yaml | 9 ++++++--- .github/workflows/lint_tests.yaml | 9 ++++++--- .github/workflows/linux_tests.yaml | 9 ++++++--- .github/workflows/macos_tests.yaml | 9 ++++++--- .github/workflows/windows_tests.yaml | 9 ++++++--- doc/source/devel/ci.rst | 5 ++--- 7 files changed, 38 insertions(+), 21 deletions(-) diff --git a/.github/workflows/completion_tests.yaml b/.github/workflows/completion_tests.yaml index cbccf5a76..3a6fd0818 100644 --- a/.github/workflows/completion_tests.yaml +++ b/.github/workflows/completion_tests.yaml @@ -2,10 +2,13 @@ name: completion-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/easybuild_tests.yaml b/.github/workflows/easybuild_tests.yaml index 45f620f03..382560a40 100644 --- a/.github/workflows/easybuild_tests.yaml +++ b/.github/workflows/easybuild_tests.yaml @@ -2,10 +2,13 @@ name: easybuild-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/lint_tests.yaml b/.github/workflows/lint_tests.yaml index ee3a63696..7748be70f 100644 --- a/.github/workflows/lint_tests.yaml +++ b/.github/workflows/lint_tests.yaml @@ -2,10 +2,13 @@ name: lint-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index 23f8442b3..ba4c0c859 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -2,10 +2,13 @@ name: linux-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index e97daca4b..0f99370b1 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -2,10 +2,13 @@ name: macos-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/windows_tests.yaml b/.github/workflows/windows_tests.yaml index c26f15db7..7f281e2fc 100644 --- a/.github/workflows/windows_tests.yaml +++ b/.github/workflows/windows_tests.yaml @@ -2,10 +2,13 @@ name: windows-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/doc/source/devel/ci.rst b/doc/source/devel/ci.rst index cc4dcf3c8..de0feca02 100644 --- a/doc/source/devel/ci.rst +++ b/doc/source/devel/ci.rst @@ -50,9 +50,8 @@ All of the above live under :file:`.github/workflows/`. .. _ClusterFuzzLite: https://google.github.io/clusterfuzzlite/ Every build/test workflow (all except :file:`differential_shellcheck.yml`, -:file:`scorecard.yml` and :file:`cflite.yml`) triggers on ``push`` to any -branch except ``c-main`` and ``c-3.2`` (legacy imported-history branches -that are not active development targets) and on every ``pull_request``. +:file:`scorecard.yml` and :file:`cflite.yml`) triggers on ``push`` and +``pull_request``, both restricted to ``main`` and ``v*.*.x`` branches. Build/test workflows ---------------------